AUDIT EXECUTIVE CENTER KNOWLEDGE BRIEF INNOVATION IN INTERNAL AUDITING. Taking personal growth, leadership, and communication to the next level

Transcription

1 AUDIT EXECUTIVE CENTER KNOWLEDGE BRIEF INNOVATION IN INTERNAL AUDITING Taking personal growth, leadership, and communication to the next level

2 Table of Contents Introduction... 1 Our product is insight... 1 Data analytics should foster innovation and enable agility... 2 Understanding values approaches... 3 Models help explain value approaches... 3 Shareholder return the function of capital gains and cash flow... 4 Operational excellence identifies waste and adds value... 4 Data analytics... 5 Stratify, classify, and get insights out of data... 5 The takeaways... 6 Create a one-page visualization of the strategic plan... 6 Map out plans for improvement... 6 Execute efficiently... 6 Create impactful visualizations... 7 Provide clarity... 7 Eliminate bias... 7 Tie the analysis back to the business... 8

3 INTRODUCTION Our product is insight Stakeholders everywhere are demanding higher performance, higher value, more insights, and greater assurance from their internal audit functions to help them operate in an increasingly complex world. Internal audit, to remain relevant, has no option but to embrace change and apply an innovation mindset to meet current and future demands. So how does internal audit take all of this to the next level? Chief Audit Executive Greg Grocholski says the key is innovation and change. Innovation, I think, is the missing discussion point. I assume that all of us are already doing a good job in internal audit. And I assume that we all want to take it to the next level in terms of personal growth, leadership, and communication, says Grocholski, vice president and chief audit executive (CAE), SABIC, Riyadh, Saudi Arabia, during a session at The IIA s 2018 General Audit Management Conference. Innovation, as defined by Wikipedia, is to make change. Make change to what? Grocholski asks. Our product, he says, answering himself. Our product, many will first say, is assurance. We provide an opinion to the audit committee for assurance. But I think the greater product is our insight. If you want to talk to the C- suite, the CEO, or the board, you have to bring insight. And you have to be innovative to bring insight. The CAE has to find the creativity, the intelligence component, and the value proposition. The value proposition is really converting insight into dollars. If your insight is not worth anything, then I doubt it is insight. So innovate to find value, Grocholski says. The question is how can internal audit innovate? We need to treat internal audit like it s a business by asking our staff what they are doing today to create value, Grocholski urges. Understanding there is also value in assurance, I say you can elevate from base-level assurance to insight. 1

4 Data analytics should foster innovation and enable agility According to The IIA s 2018 North American Pulse of Internal Audit report The Internal Audit Transformation Imperative: Most (74 percent) CAEs report their organization s maturity level for data analytics is not wellestablished or mature. Less than one third of CAEs report that their organizations extensively use even the simplest data analytics techniques. Most (71 percent) CAEs indicate that their organization s residual data analytics risks are moderate to extensive. Grocholski is not in any way impressed with the statistics above. Let s elevate the data analytics we re doing today to a new plane, Grocholski says. As we make change, we innovate. If we re going to bring our insight from data analytics to the C-suite, Grocholski continues, we better start talking about it in the context of what the C-suite knows and cares about: business strategies and business models. 2

5 UNDERSTANDING VALUES APPROACHES Models help explain value approaches To build the case for providing more insight, Grocholski presented two models for further discussion the Treacy & Wiersema Value Discipline Model and the Total Shareholder Return Model to assist in understanding different value approaches. The Treacy & Wiersema Value Discipline Model identifies three essential disciplines of an effective enterprise: product leadership, operational excellence, and customer intimacy. The model recognizes that a minimum threshold in each area is necessary to compete. Yet interestingly, the creators go on to suggest that an enterprise cannot excel in all three disciplines because they are opposing forces. If you tell a CEO that according to your audit they are spending too much money on something, Grocholski explains, that CEO may look at you and say: That has nothing to do with my strategy. I m developing innovative products. I m solving world problems. So you found twenty thousand dollars of waste somewhere. That s nice, but that s just not C-suite relevant. THE TREACY & WIERSEMA MODEL From revised paperback edition of The Discipline of Market Leaders with permission of Michael Treacy. 3

6 Shareholder return the function of capital gains and cash flow The Total Shareholder Return Model, out of The Boston Consulting Group, conceptualizes the total shareholder return as the function of capital gains and cash flow. The model, Grocholski asserts, allows you to define value to the business in terms of impact on total shareholder return. What s the focus of business? Do they want to have margin growth or do they want to have revenue growth? Then you imbed that logic and test your thinking. So if you re going for more profit growth, you have to have good products. What margin do you want on your product? What are your distribution channels? What s your supply chain model? You have to have that kind of discussion to understand what risks are embedded in the strategy to be executed, to get the desired total shareholder return, Grocholski says. TOTAL SHAREHOLDER RETURN MODEL From The Boston Consulting Group with permission. Note: Share Change refers to the change in the number of shares outstanding, not in the share price change. Operational excellence identifies waste and adds value Grocholski also sees the concept of operational excellence as an option to identify waste and add value. The goal is to replace waste with added value. So we make all waste visible. With access to all this data and all these experiences, we bring that to the discussion with the CFO or CEO, he says. Consider these types of waste: defects or missed expectations; over production; waiting (which is a hand-off confusion issue); human capital loss; supply chain and other modes of transportation; inventory turnover; inefficient movements; and excess processing, says Grocholski. Identifying waste basically requires data, observation, analysis, and independence, Grocholski continues. Independence because sometimes the business functions are too close to the activity. You and your objective and unbiased and independent mindset can challenge the data. Why? To get more insights. If you don t have that as your value proposition, you re destroying value. 4

7 DATA ANALYTICS Stratify, classify, and get insights out of data Another way to gain insight is through data analytics. Grocholski s story of innovation at SABIC began when he brought in ACL. Up until then, they had zero data analytics, just SAP and Business Warehouse reporting. We used business intelligence tools, but those are reporting tools; there is absolutely zero analytical functionality in a report until you put some functionality in to stratify, classify, and get insights out of that data. So, I sent staff to ACL school, he says. After the first year, we had 138 scripts. You may argue that is not a lot BUT we started from zero. To use an analogy, it takes the greatest effort in the plane s engine propulsion, the greatest amount of energy, to get the plane moving, he explains. Useful scripts take time to develop because, as I see it, data analytics is the purposeful, intentional pursuit of information and insights, Grocholski says. We went from 138 in the first year to now we are at about 250. There is no time to waste. So set your boundaries, set your measures, set your KPIs, and get started. Grocholski s team runs some of the scripts beginning Friday night and has reports on Monday morning. All that automation, all those manual tasks, all that work behind us, allows us to utilize the reports to get insight. To get started requires a lot of energy, but once it gets going, Grocholski assures, it is amazing to watch. 5

8 THE TAKEAWAYS Create a one-page visualization of the strategic plan Grocholski offers an example of the contents in a strategic plan as a demonstration of best practices in this area. He notes that in each of these sub-bullets in the audit process are examples of what I m going to achieve over three years; these are very specific strategic intentional directional statements about actions intended to elevate internal audit. I turn that into my one-page visual for the CEO. SAMPLE STRATEGIC PLAN VISUALIZATION Map out plans for improvement The strategic plan should identify gaps and areas for improvement, Grocholski says. If you re going to innovate, you need a map. You must intentionally and purposefully direct your attention and effort. I ask, how well are we doing on audit methodology? How well are we doing on tools and technology? Communications, how effective are our audit reports, slide decks, and interview skills? Communication is critical to being successful in internal audit. What measures assess our risk assessment process? How well does our training and development tie in with our personnel strategy? What about staff capabilities? Where are we with data analytics? Execute efficiently If I m going to invest time and effort to innovate, I need a map. The strategic plan is my map, Grocholski says of a sample one-page document that identifies the data analytics process and captures assigned responsibility. What does this allow me to do? Answering himself, Grocholski says, Well, this month, this is 6

9 going to allow me to improve our planning documents or how we do travel logistics. Or we re going to look at fraud assessment. How do we make these better? Grocholski asks. During the planning process, we look to increases efficiencies and produce greater insight. We have a one- to three-page document behind each one of these steps, telling you what we re doing, why we re doing it, what audit standard is applied to it, and what the output looks like. It s a guiding document. In addition to the guidance that this map provides, Grocholski emphasizes the importance of efficient processes: If you re inefficient with workpapers and data analytics, you can t do innovation. All you can do is use more resources and spend more money chasing an unintentional pursuit of some undefined thing. You can t really innovate with Excel because of the row and column limits. True data analytics tools do not have row and column limits. If you have to bifurcate your data using Excel, then you are just wasting time and that is not operationally excellent; that is operationally wasteful. Create impactful visualizations Grocholski notes the benefits of the one-pager as a method to communicate succinctly with the CEO. In an example, Grocholski describes coming across a pricing issue with a customer: The audit team proved the condition existed and that customer had an issue. I say, Good. Go back and run that same condition against the entire population. The results were run, confirming the problem. Then I went into the CEO s office with one slide, one piece of paper, one graph. I say, We have a problem. It was clear as day on that one page. That one graph represented 15 million lines of SAP records. If you don t have visual capability, the competency to convert data and insights into visual communication, then you ll struggle communicating with the CEO, Grocholski says. Provide clarity Innovation can just be clarity. We get lost in dialogue, Grocholski says, as he shares a one-page document showing task responsibility across assurance functions. What is relevant here is that legal, compliance, and internal audit are on the same page. They are aligned. What an insight. It is nice to have clarity and focus. Avoid the distractions. And the distractions are noise, lack of clarity, lack of purpose. Eliminate bias Grocholski suggests utilizing the Treacy & Wiersema Model to determine areas relevant to executive management. In the area of product innovation, for instance, he refers to innovation margin analysis and innovation cannibalization analysis as terms coined to define data analysis looking at costs associated with a new product. The purpose of which is not to pick an argument, but to have a strategic discussion. The insight from the data can be quite interesting, Grocholski says. Another area Grocholski looks at to increase value is on unbundled service revenue. In the case of supply chain, demurrage are waste, Grocholski explains. Demurrage happen when a truck shows up, but you are not ready to load. The truck company still charges you. That is waste. There are records on demurrage, but there is a bias in believing that everything is recorded correctly, Grocholski warns. So stratify all of the freight invoices by mode of transportation and between common 7

10 destinations. Anything too deviant from standard deviation may point to an issue. It takes less than a day to do this. Don t go into data analytics with a bias. Let the data talk to you. Tie the analysis back to the business The Total Shareholder Return Model helps internal audit determine areas of importance based off the organization s focus. If you dig into this model, Grocholski notes, this model continues to proliferate into more areas of potential focus. So you can develop a map of what is important given your understanding of the business. You define areas of relevance, and you can ask the business, Where do you want insight? Referring again to The IIA s 2018 North American Pulse of Internal Audit report, Grocholski reiterates, Personally and professionally, I don t want to be in the group of CAEs who report their data analytics capability is still immature. We are better than this. We must take the first step, we must take action in this regard. We must elevate internal audit beyond assurance and prove capable of providing valuable insight to our organization s board and management team. 8

11 ABOUT THE AUDIT EXECUTIVE CENTER The IIA s Audit Executive Center (AEC ) is the essential resource to empower CAEs to be more successful. The Center s suite of information, products, and services enables CAEs to respond to the unique challenges and emerging risks of the profession. For more information on the Center, visit ABOUT THE IIA The Institute of Internal Auditors (IIA) is the internal audit profession s most widely recognized advocate, educator, and provider of standards, guidance, and certifications. Established in 1941, The IIA today serves more than 190,000 members from more than 170 countries and territories. The association s global headquarters are in Lake Mary, Fla. For more information, visit DISCLAIMER The AEC and The IIA publish this document for informational and educational purposes. This material is not intended to provide definitive answers to specific individual circumstances and as such is only intended to be used as a guide. The AEC and The IIA recommend that you always seek independent expert advice relating directly to any specific situation. The AEC and The IIA accept no responsibility for anyone placing sole reliance on this material. COPYRIGHT Copyright 2018 by The Institute of Internal Auditors (IIA) located at 1035 Greenwood Blvd., Suite 401, Lake Mary, FL 32746, U.S.A. All rights reserved. This report, including the written content, information, images, charts, as well as the pages themselves, is subject to protection under copyright laws. As copyright owners, only The IIA has the right to 1) copy any portion; 2) allow copies to be made; 3) distribute; or 4) authorize how the report is displayed, performed, or used in public. You may use this report for non-commercial, review purposes. You may not make further reuse of this report. Specifically, do not incorporate the written content, information, images, charts, or other portions of the report into other mediums or you may violate The IIA s rights as copyright owner. If you want to do any of these things, you must get permission from The IIA. This report is reserved for your exclusive use as a member of the Audit Executive Center. To distribute this report or any contents, you must get permission from The IIA.